Galaxy Research's Alex Thorn Flags Fourth Coordinated Attack Wave Aimed at Coldcard Wallet Users
AI Market Summary
Galaxy Research flagged a fourth coordinated attack pattern linked to Coldcard wallet UTXOs, with 218 transactions affecting 462 addresses and ~388.93 BTC over a short window. The use of RBF and rapid second-hop movement suggests active laundering risk and may raise near-term on-chain uncertainty, operational risk for self-custody users, and heightened scrutiny of hardware wallet security practices.
Impact level
● Medium
Affected assets
BTC/USDT-0.39%
AI Insight · BTC/USDTAI Insight
▼ Bearish
Trade now
⚠️ AI-generated insights are based on news content and are provided for informational purposes only. They do not constitute investment advice or represent the views of BingX. Investing involves risk. Please trade responsibly.
Galaxy Research Director Alex Thorn said on X on Aug. 3 that a fourth wave of coordinated activity targeting Coldcard hardware wallet users appears to be in progress.
Thorn noted that over roughly the past 2.5 hours (blocks 960778–960792), monitors recorded 218 transactions tied to 462 suspected victim addresses, involving about 388.93 BTC. The transfers match the previously identified Coldcard UTXO fingerprint, with transaction activity running about 45 times above normal.
Some of the funds have already been forwarded to second-hop addresses. Other transactions remain unconfirmed in the mempool and have Replace-by-Fee (RBF) enabled.
Thorn urged potentially affected users to move funds off their Coldcard devices as soon as possible, using a high transaction fee.
